What is a Certificate Signing Request (CSR) and why does an SSL authority need it?
A certificate authority needs a CSR because the file carries the public key and the name you want on the certificate, signed so the authority can see the request was made with the matching private key. The authority does not receive the private key. If you lose that key, the certificate cannot be installed.
- Common name — the main hostname, not an email address.
- Public key — safe to send, because it cannot decrypt traffic by itself.
- Private key — stays on the server. A lost key means a new pair.
- Organisation and location — must match what you want printed on an OV or EV certificate.
How do you generate a 2048-bit RSA CSR and private key in cPanel?
In cPanel, open SSL/TLS, then the certificate signing request screen. Enter the domain as the common name, use a 2048-bit RSA key when the form asks for a size, and fill the city and the two-letter country code. Generate the request. Copy the encoded block, including the begin and end lines. Leave the private key on the server.
- Log in to cPanel and open SSL/TLS.
- Open Certificate Signing Requests and generate a new request.
- Set the common name to the exact hostname. Use the country code IN for India.
- Choose 2048-bit when a key length is shown.
- Copy the CSR from the begin line through the end line.
- Leave the private key on that account. Do not email it.
How do you generate a CSR in Plesk or Windows IIS?
Plesk and IIS both create the CSR on the server that will keep the private key. In Plesk, open the domain, then SSL/TLS Certificates, and complete a new certificate request. In IIS Manager, open Server Certificates and choose Create Certificate Request. Select a 2048-bit key when the wizard offers a length.
| Panel | Where to start | Key length |
|---|---|---|
| Plesk | Domain, then SSL/TLS Certificates, then a new request | 2048-bit when the panel asks |
| IIS | Server Certificates, then Create Certificate Request | Microsoft RSA SChannel provider, 2048-bit |
Menu labels move between Plesk and IIS versions. The rule that does not move: generate the request on the server that will keep the key.
How do you generate a CSR and SAN CSR from the Linux command line using OpenSSL?
On Linux, OpenSSL can create a 2048-bit RSA key and a CSR in one command. Add subject alternative names when the certificate must cover both the bare domain and www, or several host names. The key file is secret. The CSR file is what you paste into the order.
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.key -out example.csr \
-subj "/C=IN/ST=Rajasthan/L=Jaipur/O=Example/CN=example.com" \
-addext "subjectAltName=DNS:example.com,DNS:www.example.com"The -addext flag needs OpenSSL 1.1.1 or newer. example.key is the private key. Do not upload it to the authority. A wildcard name is a different certificate product. Do not invent one by adding an extra host to this command.
What common CSR mistakes cause SSL issuance delays and where do you paste the CSR?
Issuance stalls when the key is 1024-bit, the country code is not two letters, the common name is an email address, or the www name is missing from a certificate that must cover it. Paste the full request, including the begin and end lines, into the certificate order. Keep the private key.
- 1024-bit keys are rejected by current authorities. Use 2048-bit RSA unless the order asks for another type.
- The country field is two letters, such as IN, not the full country name.
- The common name is a hostname. An email address in that field stalls the order.
- Paste the begin line, the body, and the end line. A trimmed block is not a CSR.
Order the certificate from SSL certificates. After it is issued, install it with install SSL in cPanel, install an SSL certificate in IIS, or install an SSL certificate on Apache, on the same server that holds the key.